DQ, IQ, OQ, PQ: what each qualification stage proves, and what it cannot

An automation engineer is asked to sign the operational qualification protocol of a new capping machine. The supplier already ran tests at its factory, the project manager wants production to start next week, and half the checks look like the ones ticked at installation. What exactly is the signature committing to?

One thing: that this stage answered its own question, with evidence. Equipment qualification has four stages, design, installation, operational and performance qualification (DQ, IQ, OQ, PQ), and each answers a different question. Two documents frame them upstream, the quality concept and the user requirements, and two supplier tests sit between the DQ and the IQ. A file can be thick and still weak when those questions get mixed up: an IQ that runs functions, an OQ run only at the nominal setting, a PQ that repeats the OQ with product.

Qualification is about the equipment, validation about what it produces

The EU good manufacturing practice (GMP) glossary defines qualification as the “action of proving that any equipment works correctly and actually leads to the expected results”. Validation is the wider idea: proving that a procedure, process, equipment, material, activity or system leads to the expected results.

On a site the split is practical. Equipment, utilities and facilities are qualified. Processes, cleaning procedures, analytical methods and computerised systems are validated, the last under EU GMP Annex 11. The order matters too: process validation assumes the equipment does what its qualification showed, so qualification comes first.

One stage, one question

EU GMP Annex 15 (2015) asks qualification to consider every stage, from the first draft of the user requirements specification (URS) to the end of use of the equipment (§3.1). Above the URS, well-run sites keep a quality concept that frames every project. The V below shows how the stages fit with the supplier’s factory and site acceptance tests (FAT, SAT): specifications go down the left arm, tests come up the right, and each test stage checks the level opposite it.

Quality concept (QC): which quality rules must every system meet? Before any project, the site or the company sets the quality ground rules for every GMP system and piece of equipment: how a system is classified, which texts apply (EU GMP and its Annex 11, 21 CFR Part 11 where relevant), the data-integrity principles, the qualification approach and its deliverables, documentation, access and change control, calibration and maintenance, and what is expected of suppliers. Written once and kept up to date, it is the reference every URS starts from. Annex 15 does not name this document, but it is the practical way to meet §3.2, where “the essential elements of quality need to be built in at this stage”. What the quality concept cannot do is say anything about a specific machine. That is the job of the URS.

URS: what do we need from this machine? The users write it, in testable terms, and it remains the reference for the whole life cycle (§3.2). It carries the technical requirements of the system or equipment (capacity and operating ranges, materials in product contact, cleanability, alarms, interfaces, the data it must produce), each consistent with the quality concept. Many sites add a generic data-integrity URS, a standard list of requirements (unique user accounts and roles, audit trail, synchronised time, electronic signatures where used, backup and restore, archiving, true copies of exported data, security updates). The owner ticks the items that apply to this system and writes one line of justification for each item left out, and every ticked item becomes a traceable requirement like any other. Written that way, each line of the URS already tells the test writer what to prove.

DQ: does the URS cover the need, and will this design meet it? The machine does not exist yet. The DQ first confirms that the URS covers the real need and is consistent with the quality concept, with no GMP rule forgotten and no data-integrity item dropped without a reason. It then checks the URS against the proposed design, as Annex 15 asks (§3.3): the supplier’s offer, drawings and functional description, compared with the URS line by line, GMP points included (product-contact materials, cleanability, alarms, data and audit trail). Every gap is closed, or accepted with a written reason, before the order or at the latest before the design is frozen. Whether a formal DQ is needed at all, for a third identical machine say, is a decision in itself, covered in the URS article. What the DQ cannot prove is that the machine will be built as drawn.

FAT: does the machine meet the specifications before it leaves the supplier? The factory acceptance test runs at the supplier’s works, before shipment, against the URS and the functional specification. Annex 15 treats it as optional (§3.4–3.5), but it is where problems are cheapest to fix, and documentation review and some tests may count towards the IQ or OQ without being repeated “if it can be shown that the functionality is not affected by the transport and installation” (§3.6). That reuse has to be justified test by test, in writing, before anyone relies on it.

SAT: did it arrive and install without losing what the FAT showed? The site acceptance test runs on your site after delivery and installation (§3.7) and checks what transport, installation and your utilities could have changed. Like the FAT, it only counts towards qualification if you shaped the protocol, the acceptance criteria and the raw data beforehand. Neither test replaces the IQ and OQ. Used well, they save you from running the same test twice.

IQ: is it the approved design, correctly installed? The equipment is in place but does not run. The IQ is a static check: installation against drawings and specifications, components and instruments identified, utilities connected, supplier manuals and maintenance requirements collected, instruments calibrated, materials of construction verified (§3.9). A tick next to “materials OK” proves very little. The certificate for each product-contact part, filed with the IQ, is the evidence. The IQ cannot prove that anything works.

OQ: does it work across the whole operating range? Now it runs, usually without product or with a placebo. Annex 15 asks for tests built from knowledge of the process and the equipment, including upper and lower operating limits and worst-case conditions (§3.11). In practice that means every function the process relies on, at both ends of the range you will use; every alarm, interlock and reject, challenged with deliberately faulty units; and what happens when power or compressed air is lost and comes back. An alarm test becomes evidence when it records the condition provoked, the message seen and what the machine did. A successful OQ is the point at which operating and cleaning procedures, operator training and preventive maintenance are finalised (§3.12). It cannot prove performance with your product, your operators and your procedures over time.

PQ: does it perform reproducibly in real use? The equipment runs as it will in production, with the procedures and trained operators finalised after the OQ, on production materials or qualified substitutes shown to behave the same way, with worst-case batch sizes (§3.14). The tests cover the operating range of the intended process unless development data already confirm it, and the sampling frequency has to be justified. On a packaging line this is where the whole line is tested rather than each machine. The PQ cannot prove that the equipment will stay in that state. Change control and periodic review take over the day the report is signed.

Protocol before the test, report before the next stage

Every stage follows the same pattern, and the pattern is what makes the results believable.

The protocol comes first. It states the tests and the acceptance criteria, and it is approved before execution; a protocol signed after the tests only records what happened, it no longer checks anything. Test sheets are raw data, filled in at the time, with the name, the date and the measuring instrument used, whose calibration has to cover the range tested.

Failures are deviations. A result outside the criteria is recorded and investigated (Annex 15 §2.8), and changing a criterion during execution is a deviation too, one that needs a scientific justification (§2.7). Finally, the report is the gate: it summarises the results against the criteria (§2.9), and a formal release by the responsible people opens the next stage (§2.10).

Back to the engineer in the opening. What the signature commits to depends on the box. Executed by: I ran these tests and recorded what I saw. Reviewed by: the tests match the protocol and the results support the conclusion. Approved by: this stage can close, or the next one can open with listed conditions. Who signs which box is set by your quality system (Annex 15 §2.2).

The same paragraph §2.10 allows a conditional release: the next stage may start with some criteria or deviations still open, if a documented assessment shows no significant impact on the next activity. Used properly it is a legitimate tool, but only when the open points are listed, owned and closed before the final release.

What the texts actually say

The Annex 15 glossary gives one sentence per stage, and each is worth reading slowly:

• DQ: “the documented verification that the proposed design of the facilities, systems and equipment is suitable for the intended purpose.”
• IQ: facilities, systems and equipment, “as installed or modified, comply with the approved design and the manufacturer’s recommendations.”
• OQ: they “perform as intended throughout the anticipated operating ranges.”
• PQ: systems and equipment “can perform effectively and reproducibly based on the approved process method and product specification.”

Three passages give projects room to manoeuvre. Qualification documents may be combined, for example IQ and OQ (§2.5), and depending on the complexity of the equipment the two may run as one installation/operational qualification (IOQ) (§3.10). PQ may be performed together with the OQ or with process validation (§3.13). And data obtained outside the manufacturer’s own programme, a supplier’s tests for instance, may be used if the approach is justified and controls were in place when the data were acquired (General section). Each of these lets you combine documents. None of them lets you skip a question.

In the United States, the FDA’s 2011 process validation guidance asks for the same evidence without the acronyms: equipment built and installed as designed, operating in all anticipated ranges, challenged under a load comparable to routine production. The quality unit must review and approve the qualification plan and report.

Words that trip up bilingual teams

QC has three readings. In this article, the quality concept that frames every URS. In French documents, qualification de conception (the DQ), with IQ, OQ and PQ written QI, QO and QP. And in English, quality control, which French writes CQ. Say which one you mean.

QP has three readings as well: performance qualification in French, the Qualified Person who certifies batches in EU English, and on some sites a qualification plan. Spell it out in anything that crosses a language border.

“MQ” is not a stage. Some supplier offers add a “maintenance qualification”, but Annex 15 has no such thing: maintenance, calibration and periodic review keep the qualified state, they do not replace any of the four stages. Nor is commissioning qualification. Commissioning is the engineering start-up, done under good engineering practice, and its records can support the IQ and OQ when they were produced under controls you can show.

The mistakes we see most often

• A DQ written after delivery. It confirms the purchase instead of checking the design. If the order is already placed, call it a design review, record the gaps honestly and test them in the IQ and OQ.
• A URS with no quality concept behind it. Each project rewrites its data-integrity and documentation requirements from scratch, and two identical machines end up with different ones. A generic checklist, ticked and justified per system, keeps them consistent.
• An OQ at the nominal setting only. The range you test is the range you may use. A filler tested at one speed is qualified at that speed.
• Acceptance criteria copied from the supplier’s checklist. They should come from your URS and your risk analysis, not from whatever the machine happens to do.
• A PQ run by the supplier’s technician. The PQ is there to show performance with the operators and procedures that will run production.
• One “IOQ” with no line between the questions. Combining documents is allowed; losing the difference between “installed as designed” and “works across the range” is not.
• Stopping at the PQ report. The qualified state is lost one undocumented change at a time.

The same logic applies to the software inside the equipment, with a different vocabulary: specifications on one side of the V-model, the tests that verify them on the other.

A qualification signature does not say the machine is good. It says that one question has been answered with evidence, and it should be clear which one.

References

• European Commission, EU GMP Annex 15: Qualification and Validation, in operation since 1 October 2015: General section, §2, §3 and glossary.
• European Commission, EU GMP Annex 11: Computerised Systems, 2011.
• US FDA, Process Validation: General Principles and Practices, January 2011.